Protect server key

Region server key can only be used on the server side. Please save it to an environment variable or key management system and restrict read permissions.

Disable server-side keys:

• Write front-end code, web page source code or mobile installation package.
• Commit to a public or shared code repository.
• Write general business logs, error stacks or work order screenshots.
• Placed in a URL, query parameter, or request header visible to the client. Configure IP allowlisting based on your deployment, and allow access only from actual services. Before rotating the key, confirm the server configuration of all applications in the same Region, verify calls succeed after updating, and then stop using the old key. Rotate it immediately if a leak is suspected and review the call log.